---
title: HexStrike AI (Lab Only)
emoji: 🛡️
colorFrom: red
colorTo: gray
sdk: docker
app_port: 7860
pinned: false
license: mit
---

# HexStrike AI on Hugging Face — Remote MCP Endpoint

> ⚠️ **AUTHORIZED USE ONLY.** This Space exposes offensive security tools.
> Only target systems you own or have explicit written permission to test.
> Using it against third-party systems violates the Hugging Face ToS and the law.

## What this Space does

It runs two things in one container:

1. **`hexstrike_server.py`** — the internal HTTP API (bound to `127.0.0.1:8888`, **not** exposed publicly).
2. **`mcp_http_bridge.py`** — a small FastAPI app on `0.0.0.0:7860` that:
   - Serves a tiny status page at `/`
   - Exposes the HexStrike MCP tools over **HTTP/SSE** at `/mcp` (so Claude Desktop, Cursor, VS Code, or a custom HF-LLM agent can connect remotely)
   - Requires a bearer token (`HEXSTRIKE_TOKEN` secret) on every request

## How to connect an AI to it

### Option A — From Claude Desktop / Cursor / VS Code
Add to your MCP config:

```json
{
  "mcpServers": {
    "hexstrike-remote": {
      "url": "https://<your-username>-<your-space>.hf.space/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN" }
    }
  }
}
```

### Option B — From a Hugging Face-hosted LLM agent
See `agent/hf_agent.py` in the repo. It uses `huggingface_hub.InferenceClient`
with a tool-calling model (e.g. `Qwen/Qwen2.5-72B-Instruct` or
`meta-llama/Llama-3.3-70B-Instruct`) and routes tool calls to this Space's `/mcp` endpoint.

## Required Space secrets

| Secret | Purpose |
|---|---|
| `HEXSTRIKE_TOKEN` | Bearer token clients must send. Generate with `openssl rand -hex 32`. |
| `HF_TOKEN` | (Only needed by `agent/hf_agent.py`, not the Space itself.) |